Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Bilômetro

CRITICAL RISKRemoved from Chrome Web Store

Bilômetro

ID: mjfigbdcambkldpnmdigcfpncpeekedd

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

Extension Info & Metadata

Status

Removed

Version

14.78.0

Size

0.31 MB

Rating

4.9/5

Reviews

3,459

Users

90,000

Type

Extension

Updated

Oct 5, 2024

Publisher Contextual Analysis

Author: https://bilometro.brksedu.com.brView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

90,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Encontre os melhores preços e cupons de desconto com o Bilômetro.

O Bilômetro do BRKsEDU é a melhor forma de encontrar os melhores preços do mercado e de ter acesso a diversos cupons de desconto. O comparador de preços não é invasivo, e só aparece quando você de fato estiver realizando uma compra online para lhe avisar se há melhores ofertas ou cupons de desconto que possam lhe ajudar a economizar. ----------------------- Essa extensão usa links de afiliados para apoiar BRKsEDU e sua equipe.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+12.5%(+10,000 users)

Compared to 4 months ago

11 versions released in this period

Rating Count

Total: 1,910 ratings+28 (1%)

Average Rating

Current: 4.85 / 5.0+0.04

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High6

Medium2

Low0

Versions scanned

Showing 1 of 72 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
14.12.0 Code review	11

Extension Version	Code Review Findings
14.12.0	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js8
injection/eventful.js2
injection/http.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background.js (line 836)	Runs a Google OAuth implicit-flow login, extracts the raw access_token from the redirect URL fragment, and POSTs it to the extension's backend (bilometro.brksedu.com.br/acessogoogle). Exfiltrating raw Google access to…	14.12.0
2	Network Interception	critical	injection/http.js (line 13)	Monkey-patches XMLHttpRequest.prototype.open/send on every page, capturing the URL and raw request body of every XHR and stashing it in a page-scope global (window.brk_jazi). This intercepts arbitrary site API payload…	14.12.0
3	Remote Code Loading	critical	injection/eventful.js (line 21)	Installs a MutationObserver on a custom <evlist> DOM element, watching for added nodes whose attributes dispatch to a command router. Attributes (brk_ousa + brk_fase) cause the page to fetch arbitrary URLs with arbitr…	14.12.0
4	Credential Theft	high	background.js (line 728)	Login/sign-in/change-password events received from the (any-origin) content script are relayed to the backend 'conecta', 'cadastro', and 'painel/senha' endpoints by forwarding the entire brk_revoga object, which on th…	14.12.0
5	Data Exfiltration	high	injection/eventful.js (line 127)	Two command handlers reachable from the remote-attribute router above: brk_ande reads arbitrary named cookies from document.cookie (brk_dada), and brk_irma reads arbitrary window globals by name (brk_sena). Combined w…	14.12.0
6	Privilege Escalation	high	background.js (line 536)	Hardcoded list of 22 sibling extension IDs coordinated via runtime.sendMessage('ext-check'). The extension discovers which siblings are currently installed on the victim's browser and shares that inventory with partne…	14.12.0
7	Privilege Escalation	high	background.js (line 648)	Registers an onMessageExternal handler without an externally_connectable allowlist in the manifest, meaning any extension (or in some Chrome versions, any webpage) can invoke registered remote handlers. This exposes t…	14.12.0
8	Tracking	high	background.js (line 1291)	Opens a backend-chosen tracking URL (brk_travou builds it from endpoint 'tracking' with zorigem='m3' + label) as a pinned tab, waits for it to load via a signal from a content-script message, then auto-closes the tab …	14.12.0
9	Unauthorized Data Collection	high	background.js (line 584)	Iterates the hardcoded sibling list and pings each via chrome.runtime.sendMessage to enumerate which companion extensions are installed. Combined with onMessageExternal, sibling extensions can freely invoke each other…	14.12.0
10	Tracking	medium	background.js (line 519)	On install, the extension fetches a server-controlled URL from the 'plugin-instalado' endpoint and opens it in a new tab, and sets a server-controlled uninstall URL via setUninstallURL. Backend can steer users to arbi…	14.12.0
11	Tracking	medium	background.js (line 1468)	All API traffic goes to https://bilometro.brksedu.com.br with a per-install persistent device identifier (localid, UUID-like generated in brk_dizima) plus userhash derived from profile.id and profile.userhash sent as …	14.12.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


sizzlejs.com	-	https://sizzlejs.com/
js.foundation	-	https://js.foundation/
jsperf.com	/thor-indexof-vs-for/5	https://jsperf.com/thor-indexof-vs-for/5
www.w3.org	/TR/css3-selectors/	http://www.w3.org/TR/css3-selectors/#whitespace
www.w3.org	/TR/css-syntax-3/	https://www.w3.org/TR/css-syntax-3/#ident-token-diagram
www.w3.org	/TR/selectors/	http://www.w3.org/TR/selectors/#attribute-selectors
www.w3.org	/TR/CSS21/syndata.html	http://www.w3.org/TR/CSS21/syndata.html#escaped-characters
drafts.csswg.org	/cssom/	https://drafts.csswg.org/cssom/#common-serializing-idioms
html.spec.whatwg.org	/multipage/scripting.html	https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
html.spec.whatwg.org	/multipage/scripting.html	https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

quase perfeito, na maioria das vezes você não consgue os descontos mas quando consegue vale a pena

Igor Assis·9 Jan 2025

quase perfeito, na maioria das vezes você não consgue os descontos mas quando consegue vale a pena

Alisson Aquino·9 Jan 2025

Top demais, ja me ajudou a economizar em diversos produtos e serviços.

Arthur·7 Jan 2025

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Bilômetro

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 72 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating